Hack VBA protection code???

[Malcy]

Hi
I have been called in by a client who had a db app put together (not very well). The original developers simply are doing nothing and the client is in despair. They have asked me to see if I can both correct the original bugs and also develop the database on.
The history is one of many unanswered phone calls and emails with the occasional promise that never gets anywhere. We spoke to the developer today who said they couldn't give the access code and then spoke to the other part of the duo who said he didn't have the code but would see if he can talk it out of the developer.
The client is a charity and like doing things the right way so I think that they will have played fair with the developer but it hasn't been reciprocated.
In exploring what they have I have been blocked by a password when I try to get into the VBA.
Is there any way to crack into this?
It would be helpful to know so that if the promised password does not materialise (and they were not holding their breath) do I tell them it is a no-hoper, or might I be able to work through?
The only alternative would appear to be to start from scratch but I suspect that would be financially too painful for them.

There is nothing earth shattering in what it does - even if it worked properly - and it is a small FE/BE database. I have full access to the BE but need to get into the code behind forms and modules to see where it is going wrong.

Any help or pointers would be most appreciated. I recognise the ethical issues but also sympathise with a client who has been shafted.
Best wishes

 

[KeithG]

there are utilities created by third party companies to do this try a search on Google.

 

[Malcy]

Thanks Keith
I have had a look and they all have the feel of snake oil about them.
The trial versions inevitably will not "prove" that they can do the job - easy to see why!!!
Does anyone have experience of one that works?
Thanks and best wishes

 

[RuralGuy]

See if this link helps at all. I'm pretty sure Michael Kaplan (MichKa) wrote this years ago. It seems to have some compile problems but I'll bet you can fix them and try it on a backup of your db.

 

[MicroE]

http://www.google.com/search?hl=en&q=crack+Microsoft+Access+VBA+password&btnG=Google+Search

 

[Malcy]

Thanks RuralGuy for that one. I have had a look at it and tried to debug but not successful yet - might need a bit of help later on but will try harder first.
Meanwhile I did try to open a new module in a copy of the database and I cannot even open a new module without the password.
Do you think you set the crack code in a separate db and then give it the path for database you need to crack?
Sorry if it is a dumb question but never dreamed I might ever be trying this one - too honest by far!!
MicroE - thanks for the effort but that Google search is exactly the list that seems a bit snake oily to me!

 

[RuralGuy]

Malcy,
I tried it on a test db and would you believe it needs the password of the other db before it works. Phooey! I'm pretty sure MichKa did one a few years back. I'll keep looking. I might even have a copy on this hard disk somewhere. Note to self: get organized some day!

 

[RuralGuy]

Some of those password crackers seem pretty cheap. It might be worth taking a flyer for $35.

 

[Malcy]

Hi RuralGuy
Thanks for your efforts.
Yes I know costs are not high just I am a suspicious sod at heart I suppose and being a Scot would resent $35 if it didn't work (rather like that code which looked as if it might) - I guess we all have crosses to bear!
I am still exploring options but reckon I simply take a chance on one and see what it does. There is still a hope they will get the password but if not then I will see what goes.
I will try to remember to report back what I got and if it worked to help others who may find the thread in the future.
Thanks again and all best wishes to the Colorado mountains! Throw a snowball for me if you see any!!!

 

[john471]

Did the original developer supply the mdb of the front end, or only an mde ? If you don't have a copy of the mdb, then I don't think there is much hope. However, if you have an mdb I believe one of the (many) hack utilities would be able to do the trick.

I had a case where the original developer refused to supply the password (even though the company I work for owned the IP, in theory. The developer left on bad terms), but I was able to identify the owner of an account that was a memeber of the Admins group. When I located that person, they said... "oh that was years ago, and I don't remember the password." I used a demo version of a couple of the hack utilities. Of course, as you rightly stated the demo versions won't reveal the whole password, but some of them supply one or two characters... Once I was able to tell the happy fellow that the password was a**b*2** (or whatever) that was enough of a prompt for him to remember his complete password, and that got me in... so to cut a long story short, I believe the (snake oil) hacks would work, if you bought them. For me it was a case of $50 (or whatever) of my own money, for a one time use, which I wasn't too keen to gift to the company - they get enough blood already.

edit: I am presuming that it is secured using "access workgroup security", and not through their own custom coded security.

HTH

Regards

John

 

[Malcy]

Hi John
I am pretty sure that it is simply a VBA password I am needing but without it I cannot get anywhere. You are right in that I have mdb of both the FE and the BE.
Looking at the data structures I do not think it is even properly normalised so I doubt they have done much more than lock down the VBA - which is sound but I don't usually until I know it is working and this one isn't!
They are still trying to get the password but if that fails then I will try investing in snake oil tomorrow! Getting two characters would almost certainly not help since the clients had nothing to do with the setup.

 

[RuralGuy]

Malcy,
Here's the code to crack the Jet 3.0 and 3.5 passwords if that will help.
http://www.trigeminal.com/code/DatabasePassword.bas

 

[The_Doc_Man]

In the final analysis, if none of the crackers do the job and the original developer is being a snot about the whole thing, you have two last choices.

Take the guy to court for failing to honor a contract AND dangle a quitclaim if he forks over what you need - OR -

86 the whole design and start from scratch.

I'm not going to say I'm aware of the nuances of UK courts, but in the USA, we have small claims courts that are pretty easy and can provide lots of leverage on a reluctant defendant. The stick is of course the lawsuit and the carrot is the quit-claim offer.

But if that seems to be too much trouble, it is time to toss the file down the disposal unit.

 

[Malcy]

Hi RuralGuy
I tried that and it came up with -- on the next line in the Immediate Window.
I did try -- as the password just in case but it didn't work - which wasn't a huge surprise.
As the code suggested I put it in a module in a new database and typed the following into the Immediate Window
? StPasswordOfStDatabase("m:\blah\blah\CopyOfBlah.mdb")
and hit enter which I am pretty sure is right.
Looks like I may be trying out a cracker tomorrow if they do not get the key by this evening
Thanks enormously for all your help. I really appreciate it

 

[RuralGuy]

I don't use passwords but it has got my curiosity juices flowing. It might be an interesting project. Let us know if you spring for one of the crackers and it works!

 

[boblarson]

Oh, and this won't help in this instance, but if you run across a database that has just a simple database password, there's a product I've had to use in the past (free) called Db Password Sleuth and it's by ShatterRock Technologies.

 

[MicroE]

Just an FYI – I don’t know how this applies to Scotland – but in the US – software created by a third party is their intellectual property. Cracking source code passwords is illegal if the software is not your property. You may want to look into this, before going too far.

 

[Malcy]

Thanks MicroE
I will check that.
If IP has not been raised as a specific issue I vaguely recall it lies with the person commissioning the database. I know that my T&Cs specifically retain the IP with me but without T&Cs then it would be vague.
If IP is not with the client then it looks a bit like either TheDocMan's court threat - and yes we have very similar setup here though will be interesting in that the client is in Scotland, under Scottish law and the developer is in England under English law - aargh!
Alternatively they simply need to start from scratch as someone else suggested.
Thanks for all your help and suggestions.
Watch this spot (as they say) ....

 

[MicroE]

By default, Intellectual Property belongs to the creator. If the person is employed – the company that employs him/her is the owner. So if Company ABC hires a programmer from Company XYZ. Company XYZ is the owner. I am almost certain this is internationally supported. Company ABC has an exclusive license to use the software, but does not own it. The contract would have to explicitly state that Company ABC will retain ownership in order to retain the Intellectual Property.

After rereading your original post, I came to the conclusion that the developer is intentionally not releasing the password. I obviously don’t know all the details pf the situation or what your relationship is with the client. However, you are apparently caught in the middle of a dispute. I would be careful and would even consider dropping the project entirely (again - I don’t know the ins & outs of the situation).

 

[Malcy]

Thanks for the thoughts MicroE. On reflection I suspect you are right about IP ownership.
The puzzle is I don't think there is anything remotely clever within the password protected VBA and the bl**dy thing does not work!!! Looking at the data structures I suspect someone fresh out of a not terribly good college. It isn't structured that well and the field names are generally about descriptive 40 characters long (I kid you not) - perhaps they are championship speed typing standard but personally I prefer short succinct field names since fewer keystrokes to get your code in.
I have popped email to client re: IP rights and suggested some care is needed.
I also feel slightly offended that original developer not fixing the issues or releasing password to allow fix to be done since somewhere along the line we are all tarred with that same brush.